[Backport release-26.05] users: realpath home dirs before comparison (#1824)

When we create users with homedir under /var, they end up with
NFSHomeDirectory under /private/var because /var is a symlink. This
breaks consequent activations and requires that user overrides their
home dir attribute with /private/var/... to pass the activation
precheck.

`realpath` should normalize the discrepancy.

(cherry picked from commit 08278afff6)

.github/workflows/test.yml

@@ -4,10 +4,10 @@ on:
   merge_group:
   push:
     branches:
-      - master
+      - nix-darwin-26.05
 
 env:
-  NIXPKGS_BRANCH: nixpkgs-unstable
+  NIXPKGS_BRANCH: nixpkgs-26.05-darwin
   NIX_VERSION: 2.24.11
 
 jobs:

README.md

@@ -1,230 +1,3 @@
-[<img src="https://github.com/user-attachments/assets/0e1a77ac-6739-4153-bd24-abd3a5e143f5" width="200px" alt="logo" />](https://github.com/nix-darwin/nix-darwin)
-
 # nix-darwin
 
-[![Test](https://github.com/nix-darwin/nix-darwin/actions/workflows/test.yml/badge.svg)](https://github.com/nix-darwin/nix-darwin/actions/workflows/test.yml)
-
-Nix modules for darwin, `/etc/nixos/configuration.nix` for macOS.
-
-This project aims to bring the convenience of a declarative system approach to macOS.
-nix-darwin is built up around [Nixpkgs](https://github.com/NixOS/nixpkgs), quite similar to [NixOS](https://nixos.org/).
-
-## Prerequisites
-
-The only prerequisite is a Nix implementation; both Nix and Lix are supported.
-
-As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using the [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system), which supports both flake-based and channel-based setups.
-
-The installer you use doesn't affect which Nix interpreter your system will use later on. nix-darwin manages the Nix installation by default and will default to upstream Nix. If you wish to use Lix instead of Nix, set `nix.package = pkgs.lix` in your configuration.
-
-## Getting started
-
-Despite being an experimental feature in Nix currently, nix-darwin recommends that beginners use flakes to manage their nix-darwin configurations.
-
-<details>
-<summary>Flakes (Recommended for beginners)</summary>
-
-### Step 1. Creating `flake.nix`
-
-<details>
-<summary>Getting started from scratch</summary>
-<p></p>
-
-If you don't have an existing `configuration.nix`, you can run the following commands to generate a basic `flake.nix` inside `/etc/nix-darwin`:
-
-```bash
-sudo mkdir -p /etc/nix-darwin
-sudo chown $(id -nu):$(id -ng) /etc/nix-darwin
-cd /etc/nix-darwin
-
-# To use Nixpkgs unstable:
-nix flake init -t nix-darwin/master
-# To use Nixpkgs 25.11:
-nix flake init -t nix-darwin/nix-darwin-25.11
-
-sed -i '' "s/simple/$(scutil --get LocalHostName)/" flake.nix
-```
-
-Make sure to check if `nixpkgs.hostPlatform` is set to either `x86_64-darwin` for Intel or `aarch64-darwin` for Apple Silicon.
-
-</details>
-
-<details>
-<summary>Migrating from an existing configuration.nix</summary>
-<p></p>
-
-Add the following to `flake.nix` in the same folder as `configuration.nix`:
-
-```nix
-{
-  description = "John's darwin system";
-
-  inputs = {
-    # Use `github:NixOS/nixpkgs/nixpkgs-25.11-darwin` to use Nixpkgs 25.11.
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Use `github:nix-darwin/nix-darwin/nix-darwin-25.11` to use Nixpkgs 25.11.
-    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
-  };
-
-  outputs = inputs@{ self, nix-darwin, nixpkgs }: {
-    darwinConfigurations."Johns-MacBook" = nix-darwin.lib.darwinSystem {
-      modules = [ ./configuration.nix ];
-    };
-  };
-}
-```
-
-Make sure to replace `Johns-MacBook` with your hostname which you can find by running `scutil --get LocalHostName`.
-
-Make sure to set `nixpkgs.hostPlatform` in your `configuration.nix` to either `x86_64-darwin` (Intel) or `aarch64-darwin` (Apple Silicon).
-
-</details>
-
-### Step 2. Installing `nix-darwin`
-
-Unlike NixOS, `nix-darwin` does not have an installer, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-# To use Nixpkgs unstable:
-sudo nix run nix-darwin/master#darwin-rebuild -- switch
-# To use Nixpkgs 25.11:
-sudo nix run nix-darwin/nix-darwin-25.11#darwin-rebuild -- switch
-```
-
-### Step 3. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-sudo darwin-rebuild switch
-```
-
-#### Using flake inputs
-
-Inputs from the flake can also be passed into `darwinSystem`. These inputs are then
-accessible as an argument `inputs`, similar to `pkgs` and `lib`, inside the configuration.
-
-```nix
-# in flake.nix
-nix-darwin.lib.darwinSystem {
-  modules = [ ./configuration.nix ];
-  specialArgs = { inherit inputs; };
-}
-```
-
-```nix
-# in configuration.nix
-{ pkgs, lib, inputs }:
-# inputs.self, inputs.nix-darwin, and inputs.nixpkgs can be accessed here
-```
-</details>
-
-<details>
-<summary>Channels</summary>
-
-### Step 1. Creating `configuration.nix`
-
-Copy the [simple](./modules/examples/simple.nix) example to `/etc/nix-darwin/configuration.nix`.
-
-### Step 2. Adding `nix-darwin` channel
-
-```bash
-# If you use Nixpkgs unstable (the default):
-sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
-# If you use Nixpkgs 25.11:
-sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/nix-darwin-25.11.tar.gz darwin
-
-sudo nix-channel --update
-```
-
-### Step 3. Installing `nix-darwin`
-
-To install `nix-darwin`, you can just run `darwin-rebuild switch` to install nix-darwin. As `darwin-rebuild` won't be installed in your `PATH` yet, you can use the following command:
-
-```bash
-nix-build '<darwin>' -A darwin-rebuild
-sudo ./result/bin/darwin-rebuild switch -I darwin-config=/etc/nix-darwin/configuration.nix
-```
-
-### Step 4. Using `nix-darwin`
-
-After installing, you can run `darwin-rebuild` to apply changes to your system:
-
-```bash
-sudo darwin-rebuild switch
-```
-
-### Step 5. Updating `nix-darwin`
-
-You can update Nixpkgs and `nix-darwin` using the following command:
-
-```bash
-sudo nix-channel --update
-```
-</details>
-
-## Documentation
-
-The reference documentation is available:
-
-* Online: [nix-darwin reference](https://nix-darwin.github.io/nix-darwin/manual/index.html)
-* Locally in your browser via the `darwin-help` command
-* As a manual page via `man 5 configuration.nix`
-
-## Uninstalling
-
-To run the latest version of the uninstaller, you can run the following command:
-
-```
-sudo nix --extra-experimental-features "nix-command flakes" run nix-darwin#darwin-uninstaller
-```
-
-If that command doesn't work for you, you can try the locally installed uninstaller:
-
-```
-sudo darwin-uninstaller
-```
-
-## Tests
-
-There are basic tests that run sanity checks for some of the modules,
-you can run them like this:
-
-```bash
-# run all tests
-nix-build release.nix -A tests
-# or just a subset
-nix-build release.nix -A tests.environment-path
-```
-
-## Contributing
-
-Let's make Nix on macOS awesome!
-
-Don't hesitate to contribute modules or open an issue.
-
-To build your configuration with local changes you can run this. This
-flag can also be used to override darwin-config or nixpkgs, for more
-information on the `-I` flag look at the nix-build [manpage](https://nixos.org/manual/nix/stable/command-ref/nix-build.html).
-
-```bash
-sudo darwin-rebuild switch -I darwin=.
-```
-
-If you're adding a module, please add yourself to `meta.maintainers`, for example
-
-```nix
-  meta.maintainers = [
-    lib.maintainers.alice or "alice"
-  ];
-
-  options.services.alicebot = # ...
-```
-
-The `or` operator takes care of graceful degradation when `lib` from Nixpkgs
-goes out of sync.
-
-Feel free to contact us on Matrix if you have questions:
-* **User support:** [#macos:nixos.org](https://matrix.to/#/#macos:nixos.org)
-* **Development discussion:** [#nix-darwin-dev:nixos.org](https://matrix.to/#/#nix-darwin-dev:nixos.org)
+This is the 26.05 release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation

flake.lock

@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765934234,
-        "narHash": "sha256-pJjWUzNnjbIAMIc5gRFUuKCDQ9S1cuh3b2hKgA7Mc4A=",
+        "lastModified": 1779622335,
+        "narHash": "sha256-ViA62qtL5za7V3d5I8OA9q9JcFhsVAiL5jVHwEclWqk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "af84f9d270d404c17699522fab95bbf928a2d92f",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixpkgs-26.05-darwin",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "A collection of darwin modules";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
   };
 
   outputs = { self, nixpkgs }: let

modules/config/terminfo.nix

@@ -42,16 +42,17 @@
         with pkgs.pkgsBuildBuild;
         [
           alacritty
+          alacritty-graphics
+          ghostty-bin
           kitty
           mtm
           rio
           rxvt-unicode-unwrapped
           rxvt-unicode-unwrapped-emoji
           st
-          termite
           tmux
           wezterm
-        ] ++ lib.optional (pkgs ? ghostty-bin) ghostty-bin
+        ]
       )
     );
 

modules/examples/flake/flake.nix

@@ -2,8 +2,8 @@
   description = "Example nix-darwin system flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
     nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

modules/homebrew.nix

@@ -181,8 +181,8 @@ let
         ++ mapAttrsToList (k: v: "${k}=${escapeShellArg v}") config.extraEnv
         ++ [ "brew bundle --file='${brewfileFile}'" ]
         ++ optional (!config.upgrade) "--no-upgrade"
-        ++ optional (config.cleanup == "uninstall") "--cleanup"
-        ++ optional (config.cleanup == "zap") "--cleanup --zap"
+        ++ optional (config.cleanup == "uninstall") "--force-cleanup"
+        ++ optional (config.cleanup == "zap") "--zap --force-cleanup"
         ++ config.extraFlags
       );
     };
@@ -274,6 +274,21 @@ let
           for current behavior.
         '';
       };
+      trusted = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to trust this tap during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae/casks from non-official taps that haven't been trusted, aborting activation.
+          Set this to `true` for non-official taps you control so their formulae and casks are
+          installed during activation. Official taps are always trusted, so this has no effect only
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -287,7 +302,8 @@ let
           "tap ${sCfg.name}"
           + optionalString (sCfg ? clone_target) ", ${sCfg.clone_target}"
           + optionalString (sCfg ? force_auto_update)
-            ", force_auto_update: ${sCfg.force_auto_update}";
+            ", force_auto_update: ${sCfg.force_auto_update}"
+          + optionalString config.trusted ", trusted: true";
       };
   };
 
@@ -514,6 +530,27 @@ let
       # `version_file` is intentionally not exposed: it writes the installed version to a file
       # path relative to the `brew bundle` working directory, which is not meaningful during
       # nix-darwin system activation.
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this formula during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae from non-official taps that haven't been trusted, aborting activation. Set
+          this to `true` for a formula from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/formula`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain formula name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -521,14 +558,15 @@ let
     config =
       let
         sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" "link" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" "link" "trusted" ];
       in
       {
         brewfileLine =
           "brew ${sCfg.name}"
           + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
           + mkBrewfileLineBoolOrSymbolString "link" config sCfg
-          + mkBrewfileLineBoolOrSymbolString "restart_service" config sCfg;
+          + mkBrewfileLineBoolOrSymbolString "restart_service" config sCfg
+          + optionalString config.trusted ", trusted: true";
       };
   };
 
@@ -562,6 +600,27 @@ let
           on every {command}`brew bundle` run.
         '';
       };
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this cask during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load casks from non-official taps that haven't been trusted, silently skipping them. Set
+          this to `true` for a cask from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/cask`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain cask name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
+        '';
+      };
 
       brewfileLine = mkInternalOption { type = types.nullOr types.str; };
     };
@@ -569,12 +628,13 @@ let
     config =
       let
         sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "trusted" ];
       in
       {
         brewfileLine =
           "cask ${sCfg.name}"
-          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}";
+          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
+          + optionalString config.trusted ", trusted: true";
       };
   };
 in

modules/nix/nixpkgs.nix

@@ -138,7 +138,7 @@ in
       type = configType;
       description = ''
         Global configuration for Nixpkgs.
-        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
+        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/stable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/stable/#chap-packageconfig).
 
         Ignored when {option}`nixpkgs.pkgs` is set.
       '';

modules/services/github-runner/options.nix

@@ -263,7 +263,7 @@ in
 
         nodeRuntimes = mkOption {
           type = with types; nonEmptyListOf (enum [ "node20" "node24" ]);
-          default = [ "node20" "node24" ];
+          default = [ "node24" ];
           description = ''
             List of Node.js runtimes the runner should support.
           '';

modules/users/default.nix

@@ -203,7 +203,9 @@ in
               else
                 homeDirectory=$(dscl . -read ${dsclUser} NFSHomeDirectory)
                 homeDirectory=''${homeDirectory#NFSHomeDirectory: }
-                if [[ ${escapeShellArg v.home} != "$homeDirectory" ]]; then
+                configuredHomeDirectory=$(realpath ${escapeShellArg v.home})
+                homeDirectory=$(realpath "$homeDirectory")
+                if [[ "$configuredHomeDirectory" != "$homeDirectory" ]]; then
                   printf >&2 '\e[1;31merror: config contains the wrong home directory for %s, aborting activation\e[0m\n' ${name}
                   printf >&2 'nix-darwin does not support changing the home directory of existing users.\n'
                   printf >&2 '\n'

version.json

@@ -1,4 +1,4 @@
 {
   "release": "26.05",
-  "isReleaseBranch": false
+  "isReleaseBranch": true
 }